I should have said "principally motivated" instead of just "motivated" in my original statement about white hats. I'll add that as a correction to the bottom of

I should have said "principally motivated" instead of just "motivated" in my original statement about white hats. I'll add that as a correction to the bottom of my original post. The main motivation of a white hat can't be money, but sure money can come into play secondarily. To further demonstrate: As a hypothetical example, let's say there are two parties in which it would be equally responsible to disclose a vulnerability to (perhaps they jointly developed the product or service) and as a condition of payment both separately require that the vulnerability not be disclosed elsewhere, theoretically including the other party (hopefully that wouldn't be the case in reality, but again, this is hypothetical). Now let's say party one offers $4,500 and party two offers $20,000. The choice of either party is ethical on the grounds that both have been defined as equally responsible recipients of the disclosure. Therefore a determining factor is still needed, in which case, the amount of money offered is a perfectly reasonable criterion. So in short, I agree with you on that. I may not have been completely clear in my original post.